# Limit login to staff only?
**URL:** https://meta.discourse.org/t/limit-login-to-staff-only/134256
**Category:** Support
**Created:** [23 november 2019 om 08:30 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256 "2019-11-23T08:30:48Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@helmi](https://meta.discourse.org/u/helmi)
#### Post date: [23 november 2019 om 08:30 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/1 "2019-11-23T08:30:48Z")
Hey everyone,
is there a way to limit login to a forum to a certain role like moderators or admins?
Background: I’m migrating a bigger forum and while the URL to this forum is unknown to the public I want to limit the login to moderators and admins only while we do test everything after the migration and get ready for the final transfer.
I thought I would have seen some option in the past but can’t seem to find it anymore.
---
### Author:  [@JimPas](https://meta.discourse.org/u/JimPas)
#### Post date: [23 november 2019 om 20:06 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/2 "2019-11-23T20:06:37Z")
You can make it so the forum is _ **by invitation only** _ until you’re up and running. Then you can change it to accept public registrations once you’re ready. In your Dashboard go to _ **Login** _ and tick the boxes to set it up how you wish. Once you’re ready, go back and make the necessary changes.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [23 november 2019 om 21:03 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/3 "2019-11-23T21:03:20Z")
This won’t work once users are imported and their accounts activate.
A temporary reverse proxy would work with authentication but introduces complexity.
Is a DNS name change a possibility? How are you planning to manage downtime?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [24 november 2019 om 05:08 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/4 "2019-11-24T05:08:15Z")
> [@helmi](#):
>
> while the URL to this forum is unknown to the public I want to limit the login to moderators and admins only
You probably want to suspend all users so that they aren’t getting sent emails, which would keep them from being able to log in even if they should stumble on the site.
If that’s somehow not good enough, you could modify the nginx in the container to require bait auth in order to get to the site.
---
### Author:  [@helmi](https://meta.discourse.org/u/helmi)
#### Post date: [24 november 2019 om 07:38 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/5 "2019-11-24T07:38:03Z")
I totally wasn’t aware that Discourse doesn’t really have any role based capabilities. I had only used it in projects so far where this wasn’t an issue. I thought it whould be possible to limit login through that.
@JimPas as @Stephen rightfully said that won’t work for the imported users.
DNS Name change will be in place for that period as the old forum will still continue to be live in that time but as I said initially I wanted to have additional protection.
Looks like http base auth will be the only way to put additional protection on it and keep users from logging in. I need to check how that works.
Thanks guys.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [24 november 2019 om 07:39 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/6 "2019-11-24T07:39:54Z")
> [@helmi](#):
>
> DNS Name change will be in place for that period as the old forum will still continue to be live in that time but as I said initially I wanted to have additional protection.
Not exactly, you always have the good old fallback of unpublishing the public DNS record and using a hosts entry for periods. It will break Let’s Encrypt if you rebuild while public DNS is absent, but otherwise it works. Users would need to know the new DNS name AND IP address to access it.
Disabling accounts is an option, but there’s also an option to disable all email in /admin which is probably prudent.
As a thought, you can also control access from one more layer by implementing your own IdM/SSO. More work, but potentially huge payoffs in other areas down the line. All depends what you’re comfortable with.
---
### Author:  [@helmi](https://meta.discourse.org/u/helmi)
#### Post date: [24 november 2019 om 07:54 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/7 "2019-11-24T07:54:21Z")
thanks for naming the alternatives, @Stephen.
I think base auth would be the most straightforward way. Using local hosts files is a bit cumbersome for the less technical advanced staff members/moderators and IdM/SSO is definitely too much of a hazzle for the hopefully short period of time that is needed to lay the ground work for the final migration. Also we’re not super secure there so we might still not secure it at all too.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [27 augustus 2023 om 10:08 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/8 "2023-08-27T10:08:58Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [27 augustus 2023 om 10:12 UTC](https://meta.discourse.org/t/limit-login-to-staff-only/134256/9 "2023-08-27T10:12:45Z")
Just to update this one, I believe we have a ‘staff read-only’ mode now. I’m not 100% sure I know how to activate it though. 🙂 I can’t seem to find a button in the UI, other than regular ‘read-only for everyone’. 🤔
I’ll have an explore.
* * *
We have some instructions in a guide now:
> [@Read Only Modes in Discourse](https://meta.discourse.org/t/read-only-modes-in-discourse/296976):
>
> bookmark This guide explains the various read-only modes available in Discourse, how to enable and disable them, and the scenarios in which you might want to use each mode. person_raising_hand Required user level: Administrator Managing a vibrant online community on Discourse occasionally requires administrators to temporarily limit user activities. These situations can range from performing server maintenance, facilitating backups, or transitioning servers. During such times, it’s cruci…